Skip to content
Open
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
72 changes: 72 additions & 0 deletions .github/workflows/release-prod.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -212,6 +212,12 @@ jobs:
mkdir -p build
./output/bin/embedded-cluster version metadata > build/metadata.json

- name: Upload binary artifact for metadata generation
uses: actions/upload-artifact@v6
with:
name: embedded-cluster-linux-amd64
path: output/bin/embedded-cluster

- name: Cache Staging Files
env:
S3_BUCKET: "tf-staging-embedded-cluster-bin"
Expand Down Expand Up @@ -247,6 +253,72 @@ jobs:
build/*.tgz
build/metadata.json

generate-metadata:
runs-on: ubuntu-latest
needs: [get-tag, release]
strategy:
matrix:
arch: [amd64, arm64]
steps:
- uses: actions/checkout@v5

- name: Download AMD64 binary
uses: actions/download-artifact@v6
with:
name: embedded-cluster-linux-amd64
path: output/bin

- name: Make binary executable
run: chmod +x output/bin/embedded-cluster

- name: Generate ${{ matrix.arch }} metadata
run: |
mkdir -p build
CLUSTER_ARCH=${{ matrix.arch }} ./output/bin/embedded-cluster version metadata > build/metadata-${{ matrix.arch }}.json
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Mismatched Architecture SHA Corrupts ARM64 Metadata

The generate-metadata job downloads only the AMD64 binary but uses it to generate both AMD64 and ARM64 metadata by setting CLUSTER_ARCH. This causes the ARM64 metadata to contain the wrong K0sSHA value since goods.K0sBinarySHA256() reads the SHA from the embedded k0s binary in the AMD64 executable, not from an actual ARM64 binary. The ARM64 metadata will reference ARM64 artifact URLs but have an AMD64 k0s checksum, causing verification failures.

Fix in Cursor Fix in Web


- name: Upload metadata artifact
uses: actions/upload-artifact@v6
with:
name: metadata-${{ matrix.arch }}
path: build/metadata-${{ matrix.arch }}.json

upload-metadata:
runs-on: ubuntu-latest
needs: [get-tag, generate-metadata]
strategy:
matrix:
arch: [amd64, arm64]
steps:
- uses: actions/checkout@v5

- name: Download metadata
uses: actions/download-artifact@v6
with:
name: metadata-${{ matrix.arch }}
path: build

- name: Upload to S3
env:
EC_VERSION: ${{ needs.get-tag.outputs.tag-name }}
ARCH: ${{ matrix.arch }}
S3_BUCKET: "tf-staging-embedded-cluster-bin"
AWS_ACCESS_KEY_ID: ${{ secrets.STAGING_EMBEDDED_CLUSTER_UPLOAD_IAM_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.STAGING_EMBEDDED_CLUSTER_UPLOAD_IAM_SECRET }}
AWS_REGION: "us-east-1"
run: |
./scripts/ci-upload-binaries.sh metadata

- name: Upload to S3 (Prod)
env:
EC_VERSION: ${{ needs.get-tag.outputs.tag-name }}
ARCH: ${{ matrix.arch }}
S3_BUCKET: "tf-embedded-cluster-binaries"
AWS_ACCESS_KEY_ID: ${{ secrets.PROD_EMBEDDED_CLUSTER_UPLOAD_IAM_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.PROD_EMBEDDED_CLUSTER_UPLOAD_IAM_SECRET }}
AWS_REGION: "us-east-1"
run: |
./scripts/ci-upload-binaries.sh metadata

find-previous-stable:
name: Determine previous stable version
runs-on: ubuntu-latest
Expand Down
1 change: 1 addition & 0 deletions kinds/types/release_metadata.go
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ import (
// ReleaseMetadata holds the metadata about a specific release, including addons and
// their versions.
type ReleaseMetadata struct {
Architecture string `json:"architecture"` // "amd64" or "arm64"
Versions map[string]string
K0sSHA string
K0sBinaryURL string
Expand Down
7 changes: 4 additions & 3 deletions pkg-new/metadata/metadata.go
Original file line number Diff line number Diff line change
Expand Up @@ -110,9 +110,10 @@ func GatherVersionMetadata(channelRelease *release.ChannelRelease) (*types.Relea
}

meta := types.ReleaseMetadata{
Versions: versionsMap,
K0sSHA: sha,
Artifacts: artifacts,
Architecture: helpers.ClusterArch(),
Versions: versionsMap,
K0sSHA: sha,
Artifacts: artifacts,
}

chtconfig, repconfig, err := addons.GenerateChartConfigs(context.Background(), nil)
Expand Down
23 changes: 17 additions & 6 deletions scripts/ci-upload-binaries.sh
Original file line number Diff line number Diff line change
Expand Up @@ -135,17 +135,23 @@ function kotsbin() {

function metadata() {
if [ -z "${EC_VERSION}" ]; then
echo "EC_VERSION unset, not uploading metadata.json"
echo "EC_VERSION unset, not uploading metadata"
return 0
fi

# check if a file 'build/metadata.json' exists in the directory
# if it does, upload it as metadata/v${EC_VERSION}.json
if [ -f "build/metadata.json" ]; then
# append a 'v' prefix to the version if it doesn't already have one
# Upload architecture-specific metadata if provided
if [ -n "${ARCH}" ] && [ -f "build/metadata-${ARCH}.json" ]; then
retry 3 aws s3 cp --no-progress "build/metadata-${ARCH}.json" "s3://${S3_BUCKET}/metadata/v${EC_VERSION#v}-${ARCH}.json"

# For AMD64, also upload as the default metadata.json for backward compatibility
if [ "${ARCH}" == "amd64" ]; then
retry 3 aws s3 cp --no-progress "build/metadata-${ARCH}.json" "s3://${S3_BUCKET}/metadata/v${EC_VERSION#v}.json"
fi
# Fallback to legacy single metadata.json if no ARCH specified
elif [ -f "build/metadata.json" ]; then
retry 3 aws s3 cp --no-progress build/metadata.json "s3://${S3_BUCKET}/metadata/v${EC_VERSION#v}.json"
else
echo "build/metadata.json not found, skipping upload"
echo "No metadata file found, skipping upload"
fi
}

Expand All @@ -168,6 +174,11 @@ function embeddedcluster() {
# there are three files to be uploaded for each release - the k0s binary, the metadata file, and the embedded-cluster release
# the embedded cluster release does not exist for CI builds
function main() {
# If invoked with "metadata" as the first argument, only upload metadata and exit
if [ "${1:-}" == "metadata" ]; then
metadata
return 0
fi
init_vars
metadata
if [ "${UPLOAD_BINARIES}" == "1" ]; then
Expand Down
Loading